Security audit
Security checks for vulnerabilities and agentic risk
This is a low-impact kaomoji style helper with broad automatic triggers, but no evidence of hidden code, data access, persistence, or destructive behavior.
Install this only if you want OpenClaw replies in casual chat to gain a cute kaomoji style automatically. Review the trigger list first, because common greetings and emotional words may cause kaomoji to appear without an explicit request.
The skill description switches into Traditional Chinese for the core introduction and presents the skill as a Chinese-language experience, but does not mention any user opt-in or alternative language support. This is a natural-language locale constraint in user-facing documentation and fits the policy-violation category for forced language without choice.
The skill explicitly instructs proactive activation based on the model's own perception of conversational context rather than a clear user request. In a chat assistant, this can cause unintended behavior drift, injecting stylistic content into ordinary replies and reducing the predictability of when the skill is applied, including in borderline sensitive contexts.
The trigger list contains many common words like 'why', 'happy', '晚安', and similar everyday phrases across multiple languages, making activation likely during normal conversation where the user did not request stylistic modification. This broad matching can over-apply the skill, interfere with core assistant behavior, and increase the chance of inappropriate output in contexts that only superficially match emotional keywords.
The 'context sensing' rules are subjective and underspecified, telling the agent to infer atmosphere from generic exclamations and greetings without measurable criteria. Ambiguous autonomous triggering increases the risk of misfires, especially because greetings and emotional short statements are common in many conversations, including ones where decorative responses may be inappropriate.
This markdown file contains natural-language product behavior statements, so SQP-3 applies. The description emphasizes a fixed companion-style interaction pattern and presents the skill text entirely in Traditional Chinese without any indication that users can opt into another language or locale, which may conflict with a language/locale choice policy.
The style guidance fixes the output tone as colloquial/cute and the overall document is oriented toward Chinese-language interaction, but it does not state that users can opt into another language or locale. This may create a language/locale policy issue if the skill is applied to users who did not request that style or language.
This markdown file presents all user prompts and assistant responses in Chinese, and there is no surrounding text indicating that the skill is intentionally region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
The manifest sets the skill language to "zh-Hant", which indicates a fixed locale. Under the policy, language constraints should offer user choice or be clearly justified; this file provides no opt-in or justification for requiring Traditional Chinese.
No suspicious patterns detected.
